CVE-2026-60779 in Siebel Apps
Summary
by MITRE • 08/19/2026
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Marketing accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The identified vulnerability resides within the Marketing component of Oracle Siebel CRM, specifically affecting supported versions ranging from 17.0 through 26.6. This security flaw is classified as a critical integrity and availability issue with a CVSS v3.1 base score of 8.1. The vector indicates that the attack requires no user interaction and can be executed by an attacker with low privileges over a network via HTTP, highlighting significant exposure in environments where Siebel Apps are accessible through standard web protocols.
From a technical perspective, this vulnerability allows for unauthorized manipulation of critical data within the Marketing module. An adversary exploiting this flaw gains the ability to create, delete, or modify sensitive information that is central to marketing operations and customer relationship management processes. This capability directly compromises the integrity of the application's database and underlying systems, potentially leading to severe business disruption, loss of trust in data accuracy, and unauthorized access to proprietary marketing strategies or customer lists.
In addition to data integrity risks, the vulnerability poses a substantial threat to system availability. Successful exploitation can trigger complete denial-of-service conditions by causing the Siebel Apps - Marketing service to hang or crash repeatedly. This operational impact renders the application inaccessible to legitimate users, disrupting business continuity and potentially affecting downstream systems that rely on real-time marketing data updates. The combination of high-impact integrity violations and reliable denial-of-service capabilities makes this a severe threat requiring immediate attention from security operations teams.
This vulnerability aligns with CWE Category 269, which addresses Improper Privilege Management, as it allows low-privileged users to perform actions beyond their intended scope. Furthermore, the exploitation technique corresponds to MITRE ATT&CK techniques related to Data Manipulation and Service Disruption, specifically reflecting behaviors associated with unauthorized data modification and resource exhaustion attacks. Organizations should prioritize patching affected versions or implementing strict access controls and network segmentation to mitigate exposure until a permanent fix is applied.